InfoSecBulletin Cybersecurity for mankind
The Federal Communications Commission voted to start a program for labeling wireless consumer Internet of Things products with strong cybersecurity. This means that products meeting these standards will have a “U.S Cyber Trust Mark” label, helping consumers make better choices and encouraging manufacturers to improve cybersecurity.
The Commission has adopted the rules and framework for the program. The program highlights are:
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
• The U.S. Cyber Trust Mark logo will initially appear on wireless consumer IoT products that meet the program’s cybersecurity standards.
• The logo will be accompanied by a QR code that consumers can scan for easy-tounderstand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
• The voluntary program will rely on public-private collaboration, with the FCC providing oversight and approved third-party label administrators managing activities such as evaluating product applications, authorizing use of the label, and consumer education.
• Compliance testing will be handled by accredited labs.
• Examples of eligible products may include home security cameras, voice-activated
shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors.
The Commission is asking for public opinions on extra disclosure requirements. This includes whether the software or firmware for a product is made or used by a company in a country that raises national security concerns. It also includes whether customer data collected by the product will be sent to servers in such a country.
There are many IoT products that use wireless networks. They are made up of different devices and technologies, each with its own security challenges. The Commission proposed a cybersecurity labeling program for IoT last August, and the rules adopted today are based on that proposal.
According to one third party estimate, there were more than 1.5 billion attacks against IoT devices in the first six months of 2021 alone. Others estimate that there will be more than 25 billion connected IoT devices in operation by 2030.
The cybersecurity labeling program is based on existing public and private efforts for IoT cybersecurity and labeling. It highlights the need for ongoing collaboration to help consumers use this technology with more confidence. The Commission approved the action on March 14, 2024.
